本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
更新 CA (CLI)
以下过程说明如何使用 AWS CLI更新现有 CA 的状态和吊销配置。
注意
对 CA 吊销配置的更改不会影响已经颁发的证书。要使托管吊销生效，必须重新颁发较旧的证书。
更新私有 CA 的状态（AWS CLI）
使用update-certificate-authority命令。
当您的现有 CA 状态为 DISABLED 且您希望将其设置为 ACTIVE 时，这非常有用。首先，使用以下命令确认 CA 的初始状态。
$aws acm-pca describe-certificate-authority \ --certificate-authority-arn "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566" \ --output json
这会产生类似于以下内容的输出。
{
"CertificateAuthority": {
"Arn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
"CreatedAt": "2021-03-05T14:24:12.867000-08:00",
"LastStateChangeAt": "2021-03-08T13:17:40.221000-08:00",
"Type": "ROOT",
"Serial": "serial_number",
"Status": "DISABLED",
"NotBefore": "2021-03-08T07:46:27-08:00",
"NotAfter": "2022-03-08T08:46:27-08:00",
"CertificateAuthorityConfiguration": {
"KeyAlgorithm": "RSA_2048",
"SigningAlgorithm": "SHA256WITHRSA",
"Subject": {
"Country": "US",
"Organization": "Example Corp",
"OrganizationalUnit": "Sales",
"State": "WA",
"CommonName": "www.example.com",
"Locality": "Seattle"
}
},
"RevocationConfiguration": {
"CrlConfiguration": {
"Enabled": true,
"ExpirationInDays": 7,
"CustomCname": "alternative.example.com",
"S3BucketName": "DOC-EXAMPLE-BUCKET1"
},
"OcspConfiguration": {
"Enabled": false
}
}
}
}以下命令将私有 CA 的状态设置为 ACTIVE。仅当在 CA 上安装了有效证书时，才可能实现此目的。
$aws acm-pca update-certificate-authority \ --certificate-authority-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566\ --status "ACTIVE"
检查 CA 的新状态。
$aws acm-pca describe-certificate-authority \ --certificate-authority-arn "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566" \ --output json
状态现在显示为 ACTIVE。
{
"CertificateAuthority": {
"Arn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
"CreatedAt": "2021-03-05T14:24:12.867000-08:00",
"LastStateChangeAt": "2021-03-08T13:23:09.352000-08:00",
"Type": "ROOT",
"Serial": "serial_number",
"Status": "ACTIVE",
"NotBefore": "2021-03-08T07:46:27-08:00",
"NotAfter": "2022-03-08T08:46:27-08:00",
"CertificateAuthorityConfiguration": {
"KeyAlgorithm": "RSA_2048",
"SigningAlgorithm": "SHA256WITHRSA",
"Subject": {
"Country": "US",
"Organization": "Example Corp",
"OrganizationalUnit": "Sales",
"State": "WA",
"CommonName": "www.example.com",
"Locality": "Seattle"
}
},
"RevocationConfiguration": {
"CrlConfiguration": {
"Enabled": true,
"ExpirationInDays": 7,
"CustomCname": "alternative.example.com",
"S3BucketName": "DOC-EXAMPLE-BUCKET1"
},
"OcspConfiguration": {
"Enabled": false
}
}
}
}在某些情况下，您的活动 CA 可能没有配置吊销机制。如果要开始使用证书吊销列表 (CRL)，请按以下步骤操作。
向现有 CA 中添加 (AWS CLI) CRL
-
使用以下命令检查 CA 的当前状态。
$aws acm-pca describe-certificate-authority --certificate-authority-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566--output json输出确认 CA 处于状态
ACTIVE，但未配置为使用CRL。{ "CertificateAuthority": { "Arn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566", "CreatedAt": "2021-03-08T14:36:26.449000-08:00", "LastStateChangeAt": "2021-03-08T14:50:52.224000-08:00", "Type": "ROOT", "Serial": "serial_number", "Status": "ACTIVE", "NotBefore": "2021-03-08T13:46:50-08:00", "NotAfter": "2022-03-08T14:46:50-08:00", "CertificateAuthorityConfiguration": { "KeyAlgorithm": "RSA_2048", "SigningAlgorithm": "SHA256WITHRSA", "Subject": { "Country": "US", "Organization": "Example Corp", "OrganizationalUnit": "Sales", "State": "WA", "CommonName": "www.example.com", "Locality": "Seattle" } }, "RevocationConfiguration": { "CrlConfiguration": { "Enabled": false }, "OcspConfiguration": { "Enabled": false } } } } -
创建并保存一个名为（例如）的文件
revoke_config.txt，用于定义您的CRL配置参数。{ "CrlConfiguration":{ "Enabled": true, "ExpirationInDays":7, "S3BucketName": "bucket-name" } }注意
将 Matter 设备认证 CA 更新为启用时CRLs，必须将其配置为在已颁发的证书中省略该CDP扩展，以帮助符合当前 Matter 标准。为此，请定义您的CRL配置参数，如下所示：
{ "CrlConfiguration":{ "Enabled": true, "ExpirationInDays":7, "S3BucketName": "bucket-name" "CrlDistributionPointExtensionConfiguration":{ "OmitExtension": true } } } -
使用update-certificate-authority命令和吊销配置文件更新 CA。
$aws acm-pca update-certificate-authority \ --certificate-authority-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566\ --revocation-configuration file://revoke_config.txt -
再次检查 CA 的状态。
$aws acm-pca describe-certificate-authority --certificate-authority-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566--output json输出确认 CA 现在已配置为使用CRL。
{ "CertificateAuthority": { "Arn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566", "CreatedAt": "2021-03-08T14:36:26.449000-08:00", "LastStateChangeAt": "2021-03-08T14:50:52.224000-08:00", "Type": "ROOT", "Serial": "serial_number", "Status": "ACTIVE", "NotBefore": "2021-03-08T13:46:50-08:00", "NotAfter": "2022-03-08T14:46:50-08:00", "CertificateAuthorityConfiguration": { "KeyAlgorithm": "RSA_2048", "SigningAlgorithm": "SHA256WITHRSA", "Subject": { "Country": "US", "Organization": "Example Corp", "OrganizationalUnit": "Sales", "State": "WA", "CommonName": "www.example.com", "Locality": "Seattle" } }, "RevocationConfiguration": { "CrlConfiguration": { "Enabled": true, "ExpirationInDays": 7, "S3BucketName": "DOC-EXAMPLE-BUCKET1", }, "OcspConfiguration": { "Enabled": false } } } }在某些情况下，您可能需要添加OCSP撤销支持，而不是CRL像前面的步骤那样启用。在这种情况下，请使用以下步骤。
为现有 CA 添加OCSP支持 (AWS CLI)
-
创建并保存一个名为（例如）的文件
revoke_config.txt，用于定义您的OCSP参数。{ "OcspConfiguration":{ "Enabled":true } } -
使用update-certificate-authority命令和吊销配置文件更新 CA。
$aws acm-pca update-certificate-authority \ --certificate-authority-arn arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566\ --revocation-configuration file://revoke_config.txt -
再次检查 CA 的状态。
$aws acm-pca describe-certificate-authority --certificate-authority-arnarn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566--output json输出确认 CA 现在已配置为使用OCSP。
{ "CertificateAuthority": { "Arn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566", "CreatedAt": "2021-03-08T14:36:26.449000-08:00", "LastStateChangeAt": "2021-03-08T14:50:52.224000-08:00", "Type": "ROOT", "Serial": "serial_number", "Status": "ACTIVE", "NotBefore": "2021-03-08T13:46:50-08:00", "NotAfter": "2022-03-08T14:46:50-08:00", "CertificateAuthorityConfiguration": { "KeyAlgorithm": "RSA_2048", "SigningAlgorithm": "SHA256WITHRSA", "Subject": { "Country": "US", "Organization": "Example Corp", "OrganizationalUnit": "Sales", "State": "WA", "CommonName": "www.example.com", "Locality": "Seattle" } }, "RevocationConfiguration": { "CrlConfiguration": { "Enabled": false }, "OcspConfiguration": { "Enabled": true } } } }
注意
您也可以在 CA 上同时配置CRL和OCSP支持。
